Articles in this section

Configure role-based permissions for Salesforce-NetSuite (IO) integration app in Salesforce

Saikumar Rachamalla
Updated

Summary: This article lists the Salesforce profile, object, field-level, and permission set access the connection user needs for the Salesforce-NetSuite (IO) integration app, including the permission set required for real-time listeners. Use this when setting up a new connection user or troubleshooting permission errors, such as the Distributed Adaptor package showing as not installed. After completing every section, the connection user will have the access required for both standard sync and real-time listeners.

Note: In integrator.io, your Salesforce connection showing Online confirms only that OAuth authentication succeeded. It doesn't confirm that the connection user has the object, field, and permission set access described in this article. Complete every section below, including Permission set and license, before relying on connection status alone.

Administrative Permissions

Permission types

  • API Enabled
  • Bulk API Hard Delete
  • Chatter Internal User
  • Customize Application
  • Import Custom Objects
  • Lightning Console User
  • Manage Custom Permissions
  • View Setup and Configuration

Additional references: Set admin permissions

General User Permissions

Permission types

  • Activate Orders
  • Allow View Knowledge
  • Deliver Uploaded Files and Personal Content
  • Edit Activated Orders

Additional references: Set general user permissions

Permission set and license

The Salesforce-NetSuite distributed adaptor (DA) package used for real-time listeners doesn't ship with a built-in permission set. You must create and assign one manually, even after the package is installed and even after the profile-level permissions elsewhere in this article are in place.

Additional references: Permission set licenses | Create a permission set

Assign the permission set license

Assign the Salesforce API Integration permission set license to the Salesforce user integrator.io uses for this connection.

Create and assign a custom permission set

Using that permission set license, create a permission set that grants the following:

Salesforce Permission Components Permission Types
Permission set objects integrator_da__Connection__c (Connections), integrator_da__Real_Time_Sync__c (Real-Time Sync), integrator_da__Related_SObject_Sync__c (Related SObject Sync), integrator_da__Celigo_Queued_Message__c (Celigo Queued Message) Enable the following: Create, Read, Edit, Delete, with Edit and Read field-level security

The first three objects are also covered at the profile level in Custom Object Permissions for the NetSuite Package and Custom Field-Level Security, but grant them again here through the permission set, since profile access alone isn't sufficient for real-time listeners. integrator_da__Celigo_Queued_Message__c needs the same field-level security at the profile level; see Custom Field-Level Security.

Assign the finished permission set to the connection user.

Refresh the sObject list after permission changes

After assigning or changing any permission in this article, refresh the sObject list in integrator.io so the connection picks up the new access.

Deploy Apex triggers with an admin account

Deploy any generated Apex triggers using a standard Salesforce admin account, not the integrator.io connection or service account.

What the connection user doesn't need

The connection user doesn't need System Administrator, Apex Author, or the org-wide View All Data and Modify All Data system permissions. These are different from the object-level View All and Modify All permissions required elsewhere in this article, which the connection user does need. Granting the unnecessary permissions doesn't resolve permission errors and isn't required for real-time listeners to work.

Troubleshooting tip: If Salesforce shows the Distributed Adaptor package as "not installed," or offers to install an older version, this usually isn't a package problem. It typically means the connection user can't read integrator_da__Real_Time_Sync__c or integrator_da__Connection__c. Verify the connection user has the permission set described in Permission set and license before reinstalling or changing the package version.

Important: Permission sets aren't automatically reassigned when a user's Salesforce profile or license changes. Re-verify the permission set license, the custom permission set and its field-level security, and the object-level access in this article every time the connection user's profile or license changes.

Enabled Apex Class Access

Apex classes will be available post-installation.

Additional references: Define apex classes

Permission types

  • integrator_da.RealTimeExportBatch
  • integrator_da.RealTimeExportResult
  • integrator_da.RealTimeExportTrigger
  • integrator_da.RealTimeExporter
  • netsuite_conn.CeligoRESTService
  • netsuite_conn.NetSuiteConnectorPackageInstall

Object Permissions

Objects will be available post-installation.

Additional references:

Standard Object Permissions

Salesforce Permission Components Permission Types
Standard objects Accounts, Contacts, Contracts, Opportunities, Orders, Price Books, Products Enable the following: Create, Edit, Modify All, Read, View All

Custom Object Permissions for the NetSuite Package

Salesforce Permission Components Permission Types
Custom objects Connections, Contract Items, Item Fulfillments, NetSuite Financials, Real-Time Sync, Related SObject Sync Enable the following: Create, Edit, Modify All, Read, View All

Field-Level Security

Fields will be available post-installation.

Additional references:

Account Fields

Salesforce Permission Components Permission Types
Account Account Balance, Channel Tier, Credit Hold, Credit Limit, Days Overdue, NetSuite Id, NetSuite Record, NetSuite Sync Error, Overdue Balance, Skip to Export to NetSuite, Unbilled Orders Enable the following: Edit, Read

Contact Fields

Salesforce Permission Components Permission Types
Contact NetSuite Id, NetSuite Record, NetSuite Sync Error, Skip to Export to NetSuite Enable the following: Edit, Read

Contracts Fields

Salesforce Permission Components Permission Types
Contracts Bill To Tier, Contract Renewed On, Distributor, End-User, NetSuite Contract Number, NetSuite Id, NetSuite Record URL, NetSuite Renewal Opportunity, NetSuite Renewal Transaction Internal Id, Original Contract, Renewal Terms, Reseller, Ship To Tier Enable the following: Edit, Read

Opportunity Fields

Salesforce Permission Components Permission Types
Opportunity Bill To Tier, Contract Opportunity, Contract Term, Distributor, End Date, End-User, From Contract, NetSuite Id, NetSuite Opportunity Id, NetSuite Opportunity Record, NetSuite Order Number, NetSuite Originated Order, NetSuite Record, NetSuite Sync Error, Renewal Terms, Reseller, Ship To Tier, Skip to Export to NetSuite, Start Date, Sync In Progress Enable the following: Edit, Read

Opportunity Product Fields

Salesforce Permission Components Permission Types
Opportunity Product Contract Item Id, Contract Term, Discount, End Date, List Rate, NetSuite Line Id, Pricing Type, Start Date Enable the following: Edit, Read

Order Fields

Salesforce Permission Components Permission Types
Order Discount Total [NetSuite], NetSuite Id, NetSuite Order Number, NetSuite Order Status, NetSuite Record, Opportunity, Ship Date, Skip to Export to NetSuite, Sub-Total [NetSuite], Tax-Total [NetSuite], Total [NetSuite] Enable the following: Edit, Read

Order Product Fields

Salesforce Permission Components Permission Types
Order Product NetSuite Discount(%), NetSuite Line Id Enable the following: Edit, Read

Products Fields

Salesforce Permission Components Permission Types
Products NetSuite Id, NetSuite Record, Term / Pricing Type Enable the following: Edit, Read

Custom Field-Level Security

Salesforce Permission Components Permission Types
Custom Field-Level Security Celigo Queued Message, Connection, Contract Item, Item Fulfillments, NetSuite Financials, Real-Time Sync, Related SObject Sync Enable the following: Edit, Read

Downloads